Permissions-Policy is an HTTP response header that lets a site control which powerful browser features — camera, microphone, geolocation, payment, and more — are available on the page and to any embedded iframes. It succeeded the earlier Feature-Policy header with a revised syntax and a more complete specification.
Modern browsers expose a growing set of powerful APIs that require user permission: access to the camera, microphone, geolocation, accelerometer, clipboard, and so on. These APIs can be misused by third-party scripts embedded on a page — ad networks, analytics libraries, or compromised dependencies — to silently probe or collect data.
Permissions-Policy gives the page author explicit control. A page that has no need for camera access can disable it entirely, ensuring that even if a third-party script attempts to call the camera API, the browser will refuse before any permission prompt appears.
Each directive is a feature name followed by a parenthesised allowlist of origins. The allowlist uses structured-header syntax — quoted strings for specific origins, unquoted tokens for keywords.
Permissions-Policy: geolocation=(self "https://maps.example.com"), camera=(), microphone=(self)
The keyword * allows any origin. Omitting a feature from the header entirely leaves the browser's default behaviour for that feature unchanged — it does not disable it.
The earlier Feature-Policy header used a different syntax and was never fully standardised. Permissions-Policy replaces it with the structured-field value format defined in RFC 8941. The feature names are largely the same, but the allowlist syntax changed: Feature-Policy: geolocation 'self' becomes Permissions-Policy: geolocation=(self). Some browsers still accept the old header for compatibility, but new deployments should use Permissions-Policy.
A parent page cannot grant an iframe more permissions than the parent itself has. But a parent can restrict what iframes receive, even if the feature is allowed for the page. The iframe's allow attribute works alongside the header to delegate specific features:
<iframe src="https://maps.example.com/embed" allow="geolocation"></iframe>
Both the HTTP header on the parent page and the allow attribute on the iframe element must permit a feature for the iframe to access it. If either denies it, the feature is unavailable in the iframe regardless of the other.
(self) or specific trusted origins rather than allowing any embedded content to request location.Audit your Permissions-Policy with the headers tool
Open Headers Tool